Local https certs on host with hostnames

1. The problem I’m having:

I want to get local certs without exposing services to the web while using host names. Like nextcloud.mysite.com. I have several services across multiple machines so a docker stack won’t work. There might be a thread explaining this but I am not familiar with networking lingo. Keywords like reverse proxying immediately make me look somewhere else because from my limited understanding that means it is exposed to the web.

2. Error messages and/or full log output:

No errors have been generated. Caddy not installed yet.

3. Caddy version:

2.8.4

4. How I installed and ran Caddy:

I either want to install this as a docker stack using portainer or on an LXC container using tteks script.

a. System environment:

Docker or Proxmox LXC

b. Command:

bash -c “$(wget -qLO - https://github.com/tteck/Proxmox/raw/main/ct/caddy.sh)”

or

docker compose

c. Service/unit/compose file:

services:
  caddy:
    image: caddy:latest
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./site:/srv
      - caddy_data:/data
      - caddy_config:/config

volumes:
  caddy_data:
  caddy_config:

d. My complete Caddy config:

Have not created a config yet.

5. Links to relevant resources:

Howdy @v3srb, welcome to the Caddy community.

For your use case, Caddy would achieve two things. Firstly, automating certificate management (either local/self-signed, or publicly-trusted/ACME). Secondly, reverse-proxying your services.

The term “reverse proxy” doesn’t by itself imply internet-accessibility. The term simply means something that talks to your server on behalf of the client. In this case, a web server that provides HTTPS in front of your services. This can happen purely within the LAN.

The most common deployment we see for this use case involves configuring Caddy with reverse_proxy and DNS-validated ACME certificates, so that users can have green-padlock trusted HTTPS without having to open ports at the firewall.

https://caddyserver.com/docs/caddyfile/concepts
https://caddyserver.com/docs/automatic-https#dns-challenge
https://caddyserver.com/docs/caddyfile/directives/reverse_proxy